# CloudwatchApplicationInsightsServiceLinkedRolePolicy **Description**: Cloudwatch Application Insights Service Linked Role Policy `CloudwatchApplicationInsightsServiceLinkedRolePolicy` is an [AWS managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies). ## Using this policy This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles. ## Policy details + **Type**: Service-linked role policy + **Creation time**: December 01, 2018, 16:22 UTC + **Edited time:** July 25, 2024, 16:24 UTC + **ARN**: `arn:aws:iam::aws:policy/aws-service-role/CloudwatchApplicationInsightsServiceLinkedRolePolicy` ## Policy version **Policy version:** v25 (default) The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request. ## JSON policy document ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "CloudWatch", "Effect" : "Allow", "Action" : [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource" : [ "*" ] }, { "Sid" : "CloudWatchLogs", "Effect" : "Allow", "Action" : [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource" : [ "*" ] }, { "Sid" : "EventBridge", "Effect" : "Allow", "Action" : [ "events:DescribeRule" ], "Resource" : [ "*" ] }, { "Sid" : "CloudFormation", "Effect" : "Allow", "Action" : [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources", "cloudFormation:UpdateTerminationProtection" ], "Resource" : [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Sid" : "CloudFormationStacks", "Effect" : "Allow", "Action" : [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources", "cloudFormation:ListStacks" ], "Resource" : [ "*" ] }, { "Sid" : "Tag", "Effect" : "Allow", "Action" : [ "tag:GetResources" ], "Resource" : [ "*" ] }, { "Sid" : "ResourceGroups", "Effect" : "Allow", "Action" : [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource" : [ "*" ] }, { "Sid" : "ApplicationInsightsResourceGroup", "Effect" : "Allow", "Action" : [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource" : [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Sid" : "ElasticLoadBalancing", "Effect" : "Allow", "Action" : [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource" : [ "*" ] }, { "Sid" : "AutoScaling", "Effect" : "Allow", "Action" : [ "autoscaling:DescribeAutoScalingGroups" ], "Resource" : [ "*" ] }, { "Sid" : "SSMParameter", "Effect" : "Allow", "Action" : [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource" : "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Sid" : "SSMAssociation", "Effect" : "Allow", "Action" : [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Sid" : "SSMOpsItem", "Effect" : "Allow", "Action" : [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource" : [ "*" ] }, { "Sid" : "SSMTags", "Effect" : "Allow", "Action" : [ "ssm:AddTagsToResource" ], "Resource" : "arn:aws:ssm:*:*:opsitem/*" }, { "Sid" : "SSMGetCommandInvocation", "Effect" : "Allow", "Action" : [ "ssm:ListCommandInvocations", "ssm:GetCommandInvocation" ], "Resource" : [ "*" ] }, { "Sid" : "SSMSendCommand", "Effect" : "Allow", "Action" : "ssm:SendCommand", "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Sid" : "EC2", "Effect" : "Allow", "Action" : [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeNatGateways" ], "Resource" : [ "*" ] }, { "Sid" : "RDS", "Effect" : "Allow", "Action" : [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource" : [ "*" ] }, { "Sid" : "Lambda", "Effect" : "Allow", "Action" : [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource" : [ "*" ] }, { "Sid" : "EventBridgeManagedRule", "Effect" : "Allow", "Action" : [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource" : [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Sid" : "XRay", "Effect" : "Allow", "Action" : [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource" : [ "*" ] }, { "Sid" : "DynamoDB", "Effect" : "Allow", "Action" : [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource" : [ "*" ] }, { "Sid" : "ApplicationAutoscaling", "Effect" : "Allow", "Action" : [ "application-autoscaling:DescribeScalableTargets" ], "Resource" : [ "*" ] }, { "Sid" : "S3", "Effect" : "Allow", "Action" : [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource" : [ "*" ] }, { "Sid" : "States", "Effect" : "Allow", "Action" : [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource" : [ "*" ] }, { "Sid" : "APIGateway", "Effect" : "Allow", "Action" : [ "apigateway:GET" ], "Resource" : [ "*" ] }, { "Sid" : "ECS", "Effect" : "Allow", "Action" : [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource" : [ "*" ] }, { "Sid" : "ECSCluster", "Effect" : "Allow", "Action" : [ "ecs:UpdateClusterSettings" ], "Resource" : [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Sid" : "EKS", "Effect" : "Allow", "Action" : [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource" : [ "*" ] }, { "Sid" : "SNS", "Effect" : "Allow", "Action" : [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource" : [ "*" ] }, { "Sid" : "SQS", "Effect" : "Allow", "Action" : [ "sqs:ListQueues" ], "Resource" : "*" }, { "Sid" : "CloudWatchLogsDeleteSubscriptionFilter", "Effect" : "Allow", "Action" : [ "logs:DeleteSubscriptionFilter" ], "Resource" : [ "arn:aws:logs:*:*:log-group:*" ] }, { "Sid" : "CloudWatchLogsCreateSubscriptionFilter", "Effect" : "Allow", "Action" : [ "logs:PutSubscriptionFilter" ], "Resource" : [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] }, { "Sid" : "EFS", "Effect" : "Allow", "Action" : [ "elasticfilesystem:DescribeFileSystems" ], "Resource" : [ "*" ] }, { "Sid" : "Route53", "Effect" : "Allow", "Action" : [ "route53:GetHostedZone", "route53:GetHealthCheck", "route53:ListHostedZones", "route53:ListHealthChecks", "route53:ListQueryLoggingConfigs" ], "Resource" : [ "*" ] }, { "Sid" : "Route53Resolver", "Effect" : "Allow", "Action" : [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:GetFirewallRuleGroup", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:GetResolverEndpoint", "route53resolver:GetFirewallRuleGroupAssociation" ], "Resource" : [ "*" ] } ] } ``` ## Learn more + [Understand versioning for IAM policies](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [Get started with AWS managed policies and move toward least-privilege permissions](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)